Glasswire seems quite good, though you have to buy it in order to get the basic "ask to connect" feature. I've been planning to try it since forever. Zonelarm is nice too (or at least it was when I used it years ago).
https://forum.glasswire.com/t/temporarily-disable-arp-scanni...
I hope they do something about this in the new version of Glasswire that is about to be released.